diff --git a/mozilla/parser/htmlparser/src/CNavDTD.cpp b/mozilla/parser/htmlparser/src/CNavDTD.cpp index 326e675edad..1743ea37097 100644 --- a/mozilla/parser/htmlparser/src/CNavDTD.cpp +++ b/mozilla/parser/htmlparser/src/CNavDTD.cpp @@ -70,6 +70,12 @@ #include "nsLoggingSink.h" #endif +/* + * Ignore kFontStyle and kPhrase tags when the stack is deep, bug 58917. + */ +#define FONTSTYLE_IGNORE_DEPTH (MAX_REFLOW_DEPTH*80/100) +#define PHRASE_IGNORE_DEPTH (MAX_REFLOW_DEPTH*90/100) + static NS_DEFINE_IID(kISupportsIID, NS_ISUPPORTS_IID); static NS_DEFINE_IID(kIDTDIID, NS_IDTD_IID); @@ -1305,6 +1311,19 @@ nsresult CNavDTD::WillHandleStartTag(CToken* aToken,eHTMLTags aTag,nsIParserNode } } + PRInt32 stackDepth = mBodyContext->GetCount(); + if (stackDepth >= FONTSTYLE_IGNORE_DEPTH && + gHTMLElements[aTag].IsMemberOf(kFontStyle)) { + // Prevent bug 58917 by tossing the new kFontStyle start tag + return kHierarchyTooDeep; + } + + if (stackDepth >= PHRASE_IGNORE_DEPTH && + gHTMLElements[aTag].IsMemberOf(kPhrase)) { + // Prevent bug 58917 by tossing the new kPhrase start tag + return kHierarchyTooDeep; + } + /************************************************************************************** * * Now a little code to deal with bug #49687 (crash when layout stack gets too deep) @@ -1314,7 +1333,6 @@ nsresult CNavDTD::WillHandleStartTag(CToken* aToken,eHTMLTags aTag,nsIParserNode * **************************************************************************************/ - PRInt32 stackDepth = mBodyContext->GetCount(); if (stackDepth > MAX_REFLOW_DEPTH) { if (nsHTMLElement::IsContainer(aTag) && !gHTMLElements[aTag].HasSpecialProperty(kHandleStrayTag)) { @@ -2735,6 +2753,10 @@ nsresult CNavDTD::OpenTransientStyles(eHTMLTags aChildTag){ for(;theLevelGetStylesAt(theLevel); if(theStack){ + // Don't open transient styles if it makes the stack deep, bug 58917. + if (theCount + theStack->mCount >= FONTSTYLE_IGNORE_DEPTH) { + break; + } PRInt32 sindex=0;